76464cfba6e44c2b349816105428d962967640ed441962e9197b937fc8bd75ed

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Appfuscated - Cracked by Voxguard/WatermarkDecoder.exe
Size

45KB
MD5

1170198cd869a9767ce44b5a2343ef05
SHA1

b579fc5c205f89b1324f301aef02de58c536d84a
SHA256

5c745208815ef1ad703586ef1ab5ed8bf1ee2f7d5900c32a75b4f711ac3fed77
SHA512

5b57832ff5a17401815bb962c128dc5e400fd361979b2d83435024bca0a7947eebeba89e3a0be08524bf3ad835fc02c930e7a4122243e5a7275e2aed5c606603
SSDEEP

768:xMuEJvcoBUYsH57CsyPpDgsmx8/Pb0fgk:xMNJyMP5Canbsgk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe
1880	WatermarkDecoder.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	WatermarkDecoder.exe

C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\WatermarkDecoder.exe
"C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\WatermarkDecoder.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-133-0x00000000006F0000-0x0000000000702000-memory.dmp

Filesize
72KB

Download
memory/1880-134-0x0000000005650000-0x0000000005BF4000-memory.dmp

Filesize
5.6MB

Download
memory/1880-135-0x00000000050A0000-0x0000000005132000-memory.dmp

Filesize
584KB

Download
memory/1880-136-0x0000000005160000-0x000000000516A000-memory.dmp

Filesize
40KB

Download
memory/1880-137-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1880-138-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1880-139-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1880-140-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download